Is CVE-2018-18809 actively exploited?

CVE-2018-18809 has no public evidence of in-the-wild exploitation as of 2025-11-07.

What is the CVSS score for CVE-2018-18809?

CVE-2018-18809 has a CVSS score of 6.5 (MEDIUM severity). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N.

How do I patch CVE-2018-18809?

Patch guidance is available from tibco security advisories. CVEDatabase generates AI-assisted remediation guidance on demand for CVE-2018-18809.

CVE-2018-18809 - remediation guidance & executive summary

Q: Which products are affected by CVE-2018-18809?

9 products: tibco jasperreports library, tibco jasperreports library, tibco jasperreports library, tibco jasperreports library, tibco jasperreports server, and 4 more.

Description

The default server implementation of TIBCO Software Inc.'s TIBCO JasperReports Library, TIBCO JasperReports Library Community Edition, TIBCO JasperReports Library for ActiveMatrix BPM, TIBCO JasperReports Server, TIBCO JasperReports Server Community Edition, TIBCO JasperReports Server for ActiveMatrix BPM, TIBCO Jaspersoft for AWS with Multi-Tenancy, and TIBCO Jaspersoft Reporting and Analytics for AWS contains a directory-traversal vulnerability that may theoretically allow web server users to access contents of the host system. Affected releases are TIBCO Software Inc.'s TIBCO JasperReports Library: versions up to and including 6.3.4; 6.4.1; 6.4.2; 6.4.21; 7.1.0; 7.2.0, TIBCO JasperReports Library Community Edition: versions up to and including 6.7.0, TIBCO JasperReports Library for ActiveMatrix BPM: versions up to and including 6.4.21, TIBCO JasperReports Server: versions up to and including 6.3.4; 6.4.0; 6.4.1; 6.4.2; 6.4.3; 7.1.0, TIBCO JasperReports Server Community Edition: versions up to and including 6.4.3; 7.1.0, TIBCO JasperReports Server for ActiveMatrix BPM: versions up to and including 6.4.3, TIBCO Jaspersoft for AWS with Multi-Tenancy: versions up to and including 7.1.0, TIBCO Jaspersoft Reporting and Analytics for AWS: versions up to and including 7.1.0.

CVSS Metrics

Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Attack Vector: network
Complexity: low
Privileges: low
User Action: none
Scope: unchanged
Confidentiality: high
Integrity: none
Availability: none
Weaknesses: CWE-22 · Path Traversal CWE-22 · Path Traversal

Metadata

Primary Vendor: TIBCO
Published: 3/7/2019
Last Modified: 11/7/2025
Source: NIST NVD
Note: Verify all details with official vendor sources before applying patches.

Affected Products

tibco : jasperreports_librarytibco : jasperreports_librarytibco : jasperreports_librarytibco : jasperreports_librarytibco : jasperreports_servertibco : jasperreports_servertibco : jasperreports_servertibco : jaspersofttibco : jaspersoft_reporting_and_analytics

Remediation Guidance

Executive Summary

View on NIST NVD